description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\5595c1dc3d2e51a9aa52283e601b92abfd878a6ca694d548f0bda140d60d48cc = "\"C:\\Program Files\\Java\\jre-1.8\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\5595c1dc3d2e51a9aa52283e601b92abfd878a6ca694d548f0bda140d60d48cc.jar\""	java.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\5595c1dc3d2e51a9aa52283e601b92abfd878a6ca694d548f0bda140d60d48cc = "\"C:\\Program Files\\Java\\jre-1.8\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\5595c1dc3d2e51a9aa52283e601b92abfd878a6ca694d548f0bda140d60d48cc.jar\""	java.exe

description	pid	Process
Token: SeIncreaseQuotaPrivilege	6124	WMIC.exe
Token: SeSecurityPrivilege	6124	WMIC.exe
Token: SeTakeOwnershipPrivilege	6124	WMIC.exe
Token: SeLoadDriverPrivilege	6124	WMIC.exe
Token: SeSystemProfilePrivilege	6124	WMIC.exe
Token: SeSystemtimePrivilege	6124	WMIC.exe
Token: SeProfSingleProcessPrivilege	6124	WMIC.exe
Token: SeIncBasePriorityPrivilege	6124	WMIC.exe
Token: SeCreatePagefilePrivilege	6124	WMIC.exe
Token: SeBackupPrivilege	6124	WMIC.exe
Token: SeRestorePrivilege	6124	WMIC.exe
Token: SeShutdownPrivilege	6124	WMIC.exe
Token: SeDebugPrivilege	6124	WMIC.exe
Token: SeSystemEnvironmentPrivilege	6124	WMIC.exe
Token: SeRemoteShutdownPrivilege	6124	WMIC.exe
Token: SeUndockPrivilege	6124	WMIC.exe
Token: SeManageVolumePrivilege	6124	WMIC.exe
Token: 33	6124	WMIC.exe
Token: 34	6124	WMIC.exe
Token: 35	6124	WMIC.exe
Token: 36	6124	WMIC.exe
Token: SeIncreaseQuotaPrivilege	6124	WMIC.exe
Token: SeSecurityPrivilege	6124	WMIC.exe
Token: SeTakeOwnershipPrivilege	6124	WMIC.exe
Token: SeLoadDriverPrivilege	6124	WMIC.exe
Token: SeSystemProfilePrivilege	6124	WMIC.exe
Token: SeSystemtimePrivilege	6124	WMIC.exe
Token: SeProfSingleProcessPrivilege	6124	WMIC.exe
Token: SeIncBasePriorityPrivilege	6124	WMIC.exe
Token: SeCreatePagefilePrivilege	6124	WMIC.exe
Token: SeBackupPrivilege	6124	WMIC.exe
Token: SeRestorePrivilege	6124	WMIC.exe
Token: SeShutdownPrivilege	6124	WMIC.exe
Token: SeDebugPrivilege	6124	WMIC.exe
Token: SeSystemEnvironmentPrivilege	6124	WMIC.exe
Token: SeRemoteShutdownPrivilege	6124	WMIC.exe
Token: SeUndockPrivilege	6124	WMIC.exe
Token: SeManageVolumePrivilege	6124	WMIC.exe
Token: 33	6124	WMIC.exe
Token: 34	6124	WMIC.exe
Token: 35	6124	WMIC.exe
Token: 36	6124	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5964	WMIC.exe
Token: SeSecurityPrivilege	5964	WMIC.exe
Token: SeTakeOwnershipPrivilege	5964	WMIC.exe
Token: SeLoadDriverPrivilege	5964	WMIC.exe
Token: SeSystemProfilePrivilege	5964	WMIC.exe
Token: SeSystemtimePrivilege	5964	WMIC.exe
Token: SeProfSingleProcessPrivilege	5964	WMIC.exe
Token: SeIncBasePriorityPrivilege	5964	WMIC.exe
Token: SeCreatePagefilePrivilege	5964	WMIC.exe
Token: SeBackupPrivilege	5964	WMIC.exe
Token: SeRestorePrivilege	5964	WMIC.exe
Token: SeShutdownPrivilege	5964	WMIC.exe
Token: SeDebugPrivilege	5964	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5964	WMIC.exe
Token: SeRemoteShutdownPrivilege	5964	WMIC.exe
Token: SeUndockPrivilege	5964	WMIC.exe
Token: SeManageVolumePrivilege	5964	WMIC.exe
Token: 33	5964	WMIC.exe
Token: 34	5964	WMIC.exe
Token: 35	5964	WMIC.exe
Token: 36	5964	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5964	WMIC.exe

description	pid	Process	procid_target
PID 820 wrote to memory of 3552	820	java.exe	82
PID 820 wrote to memory of 3552	820	java.exe	82
PID 820 wrote to memory of 860	820	java.exe	89
PID 820 wrote to memory of 860	820	java.exe	89
PID 860 wrote to memory of 5600	860	java.exe	93
PID 860 wrote to memory of 5600	860	java.exe	93
PID 860 wrote to memory of 5452	860	java.exe	95
PID 860 wrote to memory of 5452	860	java.exe	95
PID 5600 wrote to memory of 4624	5600	cmd.exe	97
PID 5600 wrote to memory of 4624	5600	cmd.exe	97
PID 5452 wrote to memory of 5468	5452	java.exe	98
PID 5452 wrote to memory of 5468	5452	java.exe	98
PID 5468 wrote to memory of 6124	5468	cmd.exe	100
PID 5468 wrote to memory of 6124	5468	cmd.exe	100
PID 5452 wrote to memory of 5140	5452	java.exe	101
PID 5452 wrote to memory of 5140	5452	java.exe	101
PID 5140 wrote to memory of 5964	5140	cmd.exe	103
PID 5140 wrote to memory of 5964	5140	cmd.exe	103
PID 5452 wrote to memory of 4724	5452	java.exe	104
PID 5452 wrote to memory of 4724	5452	java.exe	104
PID 4724 wrote to memory of 1032	4724	cmd.exe	106
PID 4724 wrote to memory of 1032	4724	cmd.exe	106
PID 5452 wrote to memory of 5132	5452	java.exe	107
PID 5452 wrote to memory of 5132	5452	java.exe	107
PID 5132 wrote to memory of 4432	5132	cmd.exe	109
PID 5132 wrote to memory of 4432	5132	cmd.exe	109

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads